GDPR Legal Precedents
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Browse GDPR court rulings and CJEU precedents that define data protection law across Europe.
Data current as of 14 October 2026 · Updated daily
Two complaints were lodged with the Italian Public Prosecutor's office concerning acts of mobile theft. In order to identify the perpetrators, the Public Prosecutor's office requested an authorisation to obtain the telephone records of the stolen telephones from all the telephone companies. These requests concerned all the data in the possession of the telephone companies, with tracking and localisation methods, in particular the users and International Mobile Equipment Identity (IMEI) codes of the devices called or making the calls, the sites visited and reached, the times and durations of the calls and connections, the details of the cells and/or towers concerned, and the users and IMEI code of senders and receivers of SMS and MMS. These requests were made to the judge responsible for preliminary investigations at the District Court, Bolzano (‘Giudice delle indagini preliminari presso il Tribunale di Bolzano’) on the basis of an Italian National law, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003]. The referring court was uncertain whether [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+personali+%28Testo+coordinato%29 Article 132(3) of Legislative Decree n°196/2003] is compatible with [https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=CELEX:02002L0058-20091219 Article 15(1) of Directive 2002/58] (‘ePrivacy Directive’) as interpreted by CJEU, 2 March 2021, Prokuratuur, C-746/18. First, according to paragraph 45 of that judgement, national provisions that allow public authorities to access telephone records containing a set of traffic or location data are justifiable if those provisions are intended for the prosecution of serious offences such as threats to public security and other serious crimes. Second, [https://www.garanteprivacy.it/documents/10160/0/Codice+in+materia+di+protezione+dei+dati+p
Johnna Reeder is the data subject. Cardiff Bus is the controller. Following an incident on a Cardiff Bus in June 2023, Johnna Reeder requested unedited CCTV footage under the Freedom of Information Act (FOIA). Cardiff Bus refused, citing the UK GDPR and FOIA exemptions, but offered a redacted version. Reeder complained to the Information Commissioner, who upheld Cardiff Bus's decision. Reeder appealed to the First-tier Tribunal, challenging the interpretation of personal data under data protection law. The case centred on the interaction between FOIA and the data protection regime under the Data Protection Act 2018 and UK GDPR, particularly regarding the processing and disclosure of personal data. The First-tier Tribunal dismissed Reeder's appeal, affirming that the unedited CCTV footage was exempt under Section 40(2) FOIA as it contained personal data of third parties. The Tribunal applied Article 5 UK GDPR and Article 6 UK GDPR, concluding that disclosing the unedited footage would violate the principles contained in these articles. It emphasized that under data protection law, processing must be "necessary" and proportionate, which was not the case here. The Tribunal ruled that privacy rights take precedence over information rights in such cases, as per the UK GDPR's fundamental purpose of protecting individuals' privacy in data processing. It held that disclosing the unedited footage would be unlawful under the UK GDPR, and that Reeder's interests could be met through less privacy-invasive means. Accordingly, the Tribunal dismissed Reeder's appeal.
The data subject had a business credit card issued by the controller. In 2021, the controller asked the data subject to identify themselves online by taking a picture of the ID and then taking a selfie of themselves. The data subject wanted to upload a copy of the ID with a watermark on it for fraud prevention purposes (saying, for example: “copy for [the controller]”). The controller, on the other hand, rejected this copy, arguing that the data subject should upload a copy without any writing on it. Therefore, the data subject brought legal proceedings before the District Court of Amsterdam (Rechtbank Amsterdam - Rb. Amsterdam), seeking the court to declare that the controller cannot request an ID copy without the watermark and that the controller should not block the credit card. On 20 April 2022, the District Court of Amsterdam dismissed the data subject’s request. The data subject appealed the decision before the Court of Appeal of Amsterdam (Gerechtshof Amsterdam - GHAMS). They argued that the provisions of the [https://wetten.overheid.nl/BWBR0024282/2022-11-01 Money Laundering and Terrorist Financing Prevention Act (Wet ter voorkoming van witwassen en financieren van terrorisme – Wwft)] do not require that the identification process is performed in the way envisaged by the controller. Therefore, the legal basis provided for by Article 6(1)(c) GDPR cannot be used, since there is no legal obligation to require this kind of identification. Moreover, they argued that the controller should not store the copy of the ID. The controller pointed out that the electronic technique used in the scanning of the ID has currently the highest reliability in the field of authentication and that the use of this technique enables it to recognize high value forgeries of IDs better than with the use of persons trained and educated for this purpose. First of all, the court noted that the Wwft does not prescribe a way in which the identification should be conducted. Moreover, it po
The French DPA (CNIL) issued a decision against the municipality for multiple violations of the GDPR stemming from a video surveillance system and automatic license plate reading devices. According to the CNIL, the municipality was not a competent authority entitled under the [https://www.legifrance.gouv.fr/codes/texte_lc/LEGITEXT000025503132/ Internal Security Code] (Code de la sécurité intérieure) to implement automated reading devices for the registration plates of vehicles. Additionally, the collection of registration plate data for the sole purpose of responding to the requests of law enforcement officials, exercising their judicial police duties would not correspond to one of the purposes listed in article L. 251-2 of Internal Security Code. Also, the municipality was obliged to perform the DPIA, because 73 cameras covered the areas accessible to the public, inter alia areas close to major routes of passage and several public services and infrastructure. Hence, data processing at hand posed a high risk to rights and freedoms of natural persons and the duty to perform DPIA under Article 35 GDPR was due. The CNIL also found the municipality violated Article 32 GDPR for several reasons, including network infrastructure issues, usage of a server operating systems with no update-support for nearly 10 years and no maintained service by the developer, and for insufficient practices regarding the security of passwords used for applications within the community. The municipality filed an appeal to overrule the decision. The French Supreme Administrative Court (Conseil d'Etat) rejected the appeal. First, the court emphasised that the municipality implemented the devices in question for the sole purpose of responding to the requests of the security forces, i.e., making the data available to the security forces for the exercise of their judicial police duties. However, such a purpose was not provided for in article L. 251-2 of the Internal Security Code, making the ac
The data subject participated in a hunting event on 3 November 2018. During the event, another person (the controller) filmed and photographed the hunt and the data subject in order to document hunting practices and publish the material online. At the time of the recording, the data subject received no information about the the identity of the controller, the purposes of data processing, or the recipients of the data (Article 13 GDPR). On 6 November 2018, the data subject submitted an access request under Article 15 GDPR. He asked about the purposes of the processing, the categories of data processed, recipients, storage periods, legal basis, and requested a copy of all personal data concerning him. The controller did not respond. The data subject then filed a complaint at the Austrian DPA on 09 January 2019. The controller argued before the Austrian DPA that the recordings served journalistic purposes and therefore fell under the Austrian media privilege in § 9 DSG. He claimed that he acted as a form of “citizen journalist” and that complying with access requests would obstruct investigative journalism. The DPA rejected the argument that the media privilege applied. It nevertheless dismissed the data subject's complaint concerning Article 13 GDPR because it considered that the data subject already knew enough about the controller and the intended publication. However, the DPA upheld the complaint concerning Article 15 GDPR and ordered the controller to answer the access request. Both parties appealed to the Federal Administrative Court. First, the court held that the controller processed personal data within the meaning of Article 4(1) and Article 4(2) GDPR by recording photo and video material showing the data subject during the hunting event. Second, the court held that the Austrian media privilege in § 9 DSG did not apply. The court found that the controller was neither a media undertaking nor a media service within the meaning of Austrian media law. The contr
The controller appealed [https://gdprhub.eu/index.php?title=CNIL_(France)_-_SAN-2022-026 decision SAN-2022-026] of the French DPA ('CNIL') before the French Supreme Administrative Court ('Conseil d'Etat). The CNIL fined the controller €3,000,000 for failing to obtain data subjects' consent for advertising purposes, regarding "Identifiers for Vendors" when using the controller's apps on Apple devices. The DPA also ordered an injunction requiring the controller to bring its data processing into compliance within a period of three months from notification of the deliberation. This was subject to a fine of €20,000 per day of delay. The controller sought to reduce the fine amount. The Conseil d'Etat rejected the controller's request and upheld the DPA's €3,000,000 fine. First, Article 82 of the French Data Protection Act requires that any operation of collection or deposit of information stored in the terminal of a data subject must be subject to prior, clear and complete information relating to the purpose of cookies or other tracers and the means available to data subjects to oppose them, as well as the prior collection of their consent. Two exceptions exist to this requirement: (i) if the activity has the exclusive purpose of allowing or facilitating communication by electronic means and (ii) if it is strictly necessary to the provision of an online communication service at the express request of the user. The Conseil d'Etat considered that the DPA had sufficiently established the facts regarding the breach of [https://www.legifrance.gouv.fr/loda/article_lc/LEGIARTI000037813978 Article 82 of the French Data Protection Act] (loi 78-17 du 6 janvier 1978, Informatique et Libertés), as the controller did not obtain the necessary consent to collect data subjects' data and its activities did not fall into one of the exceptions to this requirement. Second, the Conseil d'Etat also held that the DPA followed the correct procedures when deciding the fine to be imposed on
Upon opening the controller’s website, a cookie banner popped up with an option to ‘accept all’ cookies or to ‘manage settings’. Once the data subject selected the ‘manage settings’ button and tried to refuse consent another banner popped up explaining that only by accepting certain tracking cookies the platform can operate in a meaningful way and that therefore consent is required. The data subject, represented by noyb, lodged a complaint with the Austrian DPA against the controller of the website, an Austrian news magazine. They alleged a violation of Article 5(1) GDPR and 6(1) GDPR for being forced to consent to Google and other tracking cookies in order to access the content on the controller’s website. Firstly, the DPA noted that the media privilege as per Article 85 GDPR did not apply as the data processed via the aforementioned services was not used for the dissemination of journalistic information. In fact, the data processing was carried out purely for advertising or analysis purposes and therefore, the media privilege does not apply. Secondly, the Austrian DPA stated that the cookies in question are not strictly necessary and their use must therefore be subject to consent by the data subject. However, the consent in the present case cannot be considered ’voluntary’ pursuant to Article 4(11) GDPR as the data subject did not have a real choice and was not in a position to refuse consent. Thirdly, the DPA concluded that legitimate interests according to Article 6(1)(f) GDPR are not relevant, as there is already a violation of the applicable ePrivacy legislation that requires consent. For that reason, the DPA held that the processing lacked a legal basis under Article 6(1) GDPR and breached the principle of good faith under Article 5(1)(a) GDPR. As a result, the DPA ordered the controller to adjust its cookie banner and resolve the above mentioned GDPR violations within 8 weeks of the decision. However, the controller appealed the decision before the Austr
The data subject wanted to enter into an energy supply contract with an energy supplier in 2020, but received a letter back on 1 October 2020 from the energy supplier that this was not possible due to an insufficient credit rating. This credit check was done by a credit reference agency (the controller). On 7 October 2020, the data subject submitted an access request under Article 15 GDPR to the controller. On 8 October 2020, the controller provided the data subject with the personal data it had of the data subject, including their name and address. It also stated that the energy supplier had made a credit inquiry to the controller about the data subject on 1 October 2020. On 7 January 2021, the data subject requested the controller to properly comply with its obligation to provide access. On 13 January 2021, the controller replied that there was no right to access under Article 15(1)(h) GDPR with regard to the calculation of credit scores and the parameters and methods that were used to calculate a risk value as those were seen as business secrets of the controller. On 17 March 2021, the data subject lodged a complaint against the controller at the Austrian DPA (“Datenschutzbehörde -DSB“). The controller argued in the proceeding that there was no automated decision-making within the meaning of Article 22 GDPR and that there was therefore no right of access under Article 15 GDPR. It furthermore argued that it calculated the credit score on the basis of the parameters “qualified payment defaults (debt collection entries, insolvency, etc.) age, and place of residence”. Regarding the data subject, the controller sent a “medium” credit score to the energy supplier. No negative payment history data was available in the controller’s system to determine the creditworthiness score of the data subject. The controller stated it collected data from publicly available sources, data from address publishers and information on payment experience provided by corporate customers an
The controller is Criteo SA, a global technology company operating in media and entertainment that does consultancy, provides software and services in relation to digital marketing, media advertising and real time ads bidding. The controller places tracking cookies for targeted advertising on computers and mobile devices of users visiting certain third party websites. The controller uses the Real Time Bidding (RTB) System to recognise a user within seconds and to show personalised ads. In another case against the controller on 15 June 2023 , the French DPA ("CNIL") fined the controller €40 million for violating various articles of the GDPR, in particular for failing to verify that the persons from whom it processed data had given their consent. On 8 August 2023, the data subject wrote to the controller that the placing of tracking cookies on the data subject’s devices without the data subject’s consent, violates [https://www.google.com/search?client=firefox-b-d&q=telecommunicatiewet+11.7a Article 11.7a(1) Dutch telecommunications law] (“Telecommunicatiewet – TW”) and Articles 5(1)(a), 6(1), 7, 13 and 14 GDPR. The controller responded that it is the responsibility of the third party websites to obtain consent. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The court prohibited the controller from placing tracking cookies on the devices of the data subject and imposed a penalty of €250 for every day they fail to comply with the decision (with a maximum of €25.000). The controller appealed this decision on 30 October 2023. The Court of Amsterdam (“Gerechtshof Amsterdam”) found that tracking cookies were placed by the controller and that the data subject’s personal data was processed in violation of the GDPR. The court therefore prohibited the controller from placing tracking cookies and upheld the imposed penalty of the District Court after the judgem
The Austrian Data Protection Authority (DSB) fined a controller 500 000€ for failing to fulfil its obligations under Articles 12 and 15-22 of the GDPR. The controller collected information and marketing classifications on the party affiliations of the entire Austrian population. Data subjects filled out more than 30 000 requests. In response, the controller created a web contact form to enforce the three most frequently used data subject rights, thereby limiting other contact options. The controller did not adequately facilitate the exercise of data subject rights by limiting them to "the three most used". The three most used data subject rights were the right of access, the right to erasure and the right to object. Other data subject rights were not included in the contact form. Data subjects requested to exercise their rights under the GDPR. The controller failed to provide appropriate mechanisms or responses to these requests, leading to complaints from the data subjects. The DSB initiated an investigation into the controller's practices following these complaints. The investigation revealed that the controller had not sufficiently complied with the GDPR, particularly regarding the facilitation of data subject rights. The controller appealed. The Federal Administrative Court dismissed the appeal of the controller as unfounded. The Federal Administrative Court upheld the DSB's decision that the controller violated Article 12(2) GDPR by failing to facilitate the exercise of data subject rights in a transparent and accessible manner, as it restricted requests to only three data subject rights through a mandatory contact form: 1. right of access, 2. right to erasure, and 3. right to object. The Federal Administrative Court held that the requirement to provide a copy of an ID as a prerequisite for exercising these rights violated Article 12(6) GDPR, as it imposed an unnecessary burden on data subject.
The data subject brought an action against AS Ühisteenused, a company providing parking services ('controller 1'). The company that made a claim against the data subject arising from a contractual penalty in the amount of €79,57 for a car parking violation. According to a debt notice of 29 April 2022 sent to the data subject, the violation occurred on the 17 April 2019 and the penalty was to be paid by 2 May 2019. The data subject sold the car on 27 August 2019, and was not aware of AS Ühisteenused's parking regulations or the alleged violation on 17 April 2019, as they did not personally use the car. On 25 March 2022, AS Ühisteenused and Julianus Inkasso OÜentered, a debt collection company (‘controller 2’) entered into an agency agreement on the basis of which and Julianus Inkasso OÜ was authorized to represent AS Ühisteenused in the recovery of the debt owed by the data subject. As two controllers jointly determined the purposes and means of processing, they became joint controllers under Article 26 GDPR. As a result, the data subject’s debt was published on the website taust.ee (eng translation: background.ee) by Julianus Inkasso OÜ. On 29 May 2022, the data subject requested both controllers to stop processing their personal data and delete them from the website. According to [https://www.riigiteataja.ee/akt/106072023098 §146 of the Estonian Civil Code], the expiry date for the request arising from a violation of the law is three years. Since the penalty was to be paid by 2 May 2019, the three-year deadline expired on 3 May 2022 and the claim was therefore time-barred. Therefore, the data subject asked a court to order the controller 2 to delete the debt information linked to them and to pay €270 by way of damages for per-litigation legal costs. In its reply, controller 1 stated that they have a right to disclose this type of data. In particular, under [https://www.riigiteataja.ee/akt/104012019011 § 10(2)(5) of the Estonian Data Protection Act], the transf
In 2003, the data subject opened an account with revolving credit at a Dutch bank, ING Bank N.V. (the controller). In October 2006, the data subject had a delay in the payment of his credit. In December 2006, the controller terminated the data subject’s contract and claimed payment of the then outstanding debt of €27,985.63. In 2007, the data subject made a payment arrangement, but ceased to honour this arrangement after paying only a few instalments. The controller sent letters requesting payments in 2015, 2017 and 2019 to the data subject. On 23 March 2023, the data subject successfully invoked the statute of limitations. The data subject’s balance deficit was registered by the controller in the Central Credit Information System (“Centraal Krediet Informatiesysteem – CKI”), which is administered by the Central Credit Registration Office (“Bureau Krediet Registratie – BKR”). The controller is obligated under [https://wetten.overheid.nl/BWBR0020368/2024-07-10 Article 4(32) of the Dutch financial Supervision Act] (“Wet financieel toezicht – Wft”) to participate in the Central Credit Information System. The aim of the credit registration is twofold: on the one hand to protect consumers from over-indebtedness, and on the other hand to protect credit providers from borrowers who have been found to be unable or unwilling to repay their loans. The workings of the CKI is laid down in the Dutch General Regulations CKI (“Algemeen Reglement CKI – AR”), including that the retention period is five years after fulfilling the debts. In this case, the retention period started when the data subject invoked the statute of limitations, thereby writing off his debts. The data subject then requested the controller to erase the registration. The controller did not comply. The data subject filed an urgency procedure (“kort geding”) under Dutch civil law at the Amsterdam District Court (“Rechtbank Amsterdam”) against the controller. The data subject requested the court to order the cont
In April 2019, following Article 15 GDPR, the data subject requested access to his personal data from an insurance company related to a terminated pension insurance contract that was initiated in 2004 and settled by 2017. The information included transcripts of statements and copies of data from the contract in order to be able to examine a possible right of withdrawal. The controller provided the personal data it had stored (name, address, date of birth, email address, bank details, nationality, marital status, health data) and financial details like the total contributions paid, but the data subject considered it was insufficient, particularly regarding specific data and documentation related to the insurance dealings. The data subject requested the following data: # the statements made by the controller to the data subject (letters of termination, statements and enquiries regarding the contract, statements regarding the state of health); # the statements made by the controller to the data subject or to third parties (insurance certificate with supplements, cover letters, termination letters, payment reminders, settlement letters, notifications about the status of the contract); # accounting data for each incoming and outgoing payment stored in relation to the data subject's insurance contract; and # the fund profits achieved, the amount of the administration, distribution and acquisition costs deducted from the data subject's insurance premium, the capital at risk, the probability of loss occurrence and/or the actual value of the risk protection. In 2020, the Regional Court of Stuttgart (Landgericht Stuttgart - LG Stuttgart) dismissed the claim because there was no entitlement to further information than that already provided. In 2021, upon appeal by the data subject, the Higher Regional Court of Stuttgart (Oberlandesgerichts Stuttgart - OLG Stuttgart) partially amended the Regional Court’s judgment and ordered the controller to provide the data subject with in
On 19 February and 4 March 2023, a data subject contacted the Norwegian DPA to notify them about the Statistics Norway's (“the controller”) processing of personal data which they believed to be in violation with the GDPR. The data subject gave several examples on how the controller breached the GDPR, including that the controller collected all mobile data in Norway and that it sold confidential personal data identified by social security number. On 6 July 2023, the DPA replied in a letter that his inquiry had been dealt with. The DPA further stated that it would not carry out further investigations as they found it unlikely that a possible breach of the law would lead to corrective measures. Therefore, the DPA closed the case. On 25 July 2023, the data subject lodged a complaint with the DPA, requesting erasure from the controller and other controllers who received personal data from the controller. The DPA processed the complaint and upheld its decision to close the case without conducting further investigations. On 22 September 2023, the case was forwarded to the Norwegian Privacy Appeals Board (“Personvernnemnda”). The Privacy Appeals Board examined whether the DPA fulfilled their duty as supervisory body under the GDPR by closing this case without further investigations. According to Article 57(1)(f) GDPR, the DPA must handle a complaint lodged by a registered person and investigate, to the extent appropriate, the subject matter of the complaint and inform the registered person of the progress and outcome of the investigation within a reasonable period. The Board stated that the DPA has a certain freedom to decide how extensive the individual case requires investigation. In a previous case ([https://pvn.no/PVN-2017-09 PVN-2017-09]), the Board stated that the DPA is allowed to prioritise cases “to a certain extent that not all inquiries are treated equally thoroughly.” The DPA is required to fulfil its duty to investigate and provide information so that the par
The data subject is a user of the Facebook, Instagram and WhatsApp platforms. On 3 November 2023, Facebook (“the controller”) introduced their “Pay or Okay” model. On 10 November 2023, the data subject consented to the use of their data for ads on Facebook and Instagram. On 15 May 2023, the data subject requested access, damages and injunctive relief from the Regional court Regensburg (“Landgericht Regensburg”). The controller answered that it could not reply within the deadline under Article 12(3) GDPR, but only within three months’ time. The controller replied on 5 June 2023. The controller stated that it does not forward any information for advertising purposes to advertisers who personally identify users in the context of the processing at issue, unless the user has consented to the forwarding of their data to a specific advertiser. On 13 February 2024, the data subject amended its application and requested the Regional court Regensburg (“Landgericht Regensburg”) to order the controller to provide access under Article 15 GDPR and answer the specific questions the data subject had about their personal data in connection with the targeted advertising. Moreover, the data subject requested the Court to order the controller to pay the data subject non-material damages and to erase the personal data collected in the period between 25 May 2018 and 6 November 2023 under Article 17 GDPR. The data subject argued that they suffered a loss of control over its personal data. The inadequate information provided by the controller resulted in the data subject not knowing how their personal data had possibly been passed on to which third parties, or how it had been used by the controller for targeted advertising. Moreover, the data subject argued that they had received a lot of spam due to leaked data from his Facebook account. The data subject also argued that they always found the use of their personal data for the purposes of advertising aimed at them personally unpleasa
On 15 November 2019, the controller notified the Hessian DPA (“HBDI”) of a personal data breach pursuant to Article 33 GDPR as one of its employees had, on several occasions, unlawfully accessed personal data of one of the controller’s customers (“data subject”). The controller considered that this personal data breach was not likely to result in a high risk for the data subject as (i) it had taken disciplinary measures against the employee concerned, (ii) the employee had also confirmed in writing that she had not copied or retained the data, nor transferred it to third parties and (iii) she also promised not to do so in the future. In addition, (iv) the controller indicated that it would review the length of time for which access logs were kept. Therefore, the controller did not notify the data subject under Article 34 GDPR. However, the data subject became incidentally aware that his personal data had been improperly accessed and lodged a complaint with the HBDI regarding, inter alia, the failure to communicate the data breach to him in violation of Article 34 GDPR. On 3 September 2023, the HBDI informed the data subject that the controller did not infringe Article 34 GDPR, since the controller's assessment regarding the risk for the data subject was not manifestly incorrect. No corrective measures were adopted against the controller. The data subject lodged an action against this decision with the Administrative Court of Wiesbaden (Verwaltungsgericht Wiesbaden) asking it to order the HBDI to take action against the controller. The data subject indicated that the DPA had failed to handle his complaint in accordance with the requirements of the GDPR and, in particular, to adopt a measure under Article 58 GDPR. The Administrative Court of Wiesbaden referred a question to the CJEU: * When a DPA finds that a data processing has infringed the data subject’s rights, must the DPA always take action in accordance with Article 58(2) GDPR? Advocate General Priit P
The data subject was a client of juris, a company operating a legal database (“controller”). On 6 November 2018, the data subject learnt that his personal data was being used by the controller for the purposes of direct marketing. The data subject therefore revoked his consent to receive information by the company by email or by telephone, and objected to the processing of those data, except for the newsletter which he wished to continue to receive. On January 2019, he received advertising leaflets to his business address. These leaflets contained a “trial personal code” which gave access to an order form for the controller’s products and included information relating to the data subject. This was confirmed by notary at the data subject’s request. In April 2019, the data subject informed the controller that the creation of those prospectuses constituted unlawful processing. He therefore requested compensation for the damage he suffered, under Article 82 GDPR. In May 2019, he received a new advertising leaflet and reiterated his objection by bailiff. The data subject sued the controller before the Landgericht Saarbrücken (Regional Court, Saarbrücken) requesting compensation for his material damage, relating to the costs of the bailiff and notary costs incurred by the data subject, as well as his non material damage. The controller argued that it has established a system for managing objections to marketing and that the late taking into account of the data subject’s objections was either (i) due to the fact that one of its employees had not complied with the instructions given or (ii) it would have been excessively onerous to take the objections into account. The Regional Court stayed the proceedings and referred four questions to the CJEU. The third and fourth questions were combined: # Is the infringement of the provisions of the GDPR which confer rights on the data subject sufficient to constitute non-material damage within the meaning of Article 82(1) GDPR? # Ca
A company (the controller) entered into contract with another company represented by its CEO (the data subject). The data subject claimed that after the conclusion of the contract between the companies, the controller processed their data for marketing purposes, as they received marketing calls from the controller. The data subject requested (via e-mail) the controller to delete their data under Article 17 GDPR. Nevertheless, the data subject received another marketing call. The data subject file a complaint with the Polish DPA (UODO). During the proceedings, the controller explained that the data they processed were treated as data of a legal person, not the data subject’s data. After the investigation, the DPA stated that the controller processed the data under Article 6(1)(b) GDPR, since there was contractual relationship between the controller and the company represented by the data subject. Hence, the data provided with the controller served the purpose of facilitating the contract. Afterwards, the data subject filed another deletion request under Article 17 GDPR, regarding all their data processed by the controller. The controller answered the request and asked the data subject to clarify whether they wished to close the account with the controller. If so, the data subject was asked to send written application to close the account and delete the data. Once again, the data subject received marketing call from the controller. The data subject’s data was eventually deleted once the DPA contacted the controller. The DPA issued the reprimand against the controller for unlawful processing of data for marketing purposes. For the DPA, after the second deletion request, there was no legal basis in place to process the data for marketing purposes. The controller brought an appeal against the DPA’s decision before the Voivodeship Administrative Court in Warsaw (Wojewódzki Sąd Administracyjny w Warszawie). The controller argued that, inter alia, they didn’t contac
A journalist (‘data subject’) demanded an apology in relation to himself and to the citizens of the Czech Republic (‘CZ’) from the Ministry of Industry and Trade of the CZ (‘controller’) as a compensation for the non-material damages suffered as a result of the incorrect transposition of Directive 2002/58 of the European Parliament and of the Council /EC of 12 July 2002 on the processing of personal data and the protection of privacy in the electronic communications sector (‘e-Privacy Directive’ or ‘Directive’). According to the Czech law transposing the Directive, operators of electronic communications and public networks must store a variety of user communication information for six months, primarily to aid in the investigation of criminal and misdemeanor activates. The incorrect transposition of the Directive allegedly led to the widespread collection and processing of operation and location data of users' the electronic communications. In this case, the data subject saw an interference with his rights to privacy and informational self-determination. Before filing the lawsuit, the data subject tried unsuccessfully to obtain the erasure of data stored on him through a mobile operator and later through the Czech DPA. The DPA stated that, in their opinion, it is indisputable that the national legislation issue (§ 97 paragraph 3 of Act No. 127/2005 Coll.) is not in accordance with Article 15 ePrivacy Directive. According to the Directive, Member States may enact laws to limit certain rights outlined in the Directive, including data retention, if it is necessary for national security, defense, public safety, or crime prevention, in line with EU principles. However, the complaint was rejected by the DPA. Nevertheless, the data subject brought the DPA's opinion to the controller's attention who rejected it claiming that this transposition of the Directive cannot be considered as 'improper official procedure' according to Act No. 82/1998 Coll., on liability for da
On 2 May 2023, a person identifying themself under the name of the data subject lodged a complaint with the DPA against a controller, a court. This complaint alleged that the controller had not provided information as required by Article 13 and Article 14 GDPR. On 24 January 2024, the data subject filed an inactivity suit against the DPA on the same matter, requesting access to the administrative file. In a procedural order on 25 January 2024, the court requested the alleged data subject to provide proof of their identity within two weeks as there were doubts about whether the person acting in the case was in fact the data subject. On 6 February 2024, a submission arrived under the data subject’s name with a declaration of personal and economic circumstances and other documents, noting the data subject was unable to attend due to illness. A follow-up order on 9 February 2024 reminded the data subject of the identity requirement and sought justification for why access to the file should be transmitted in print or electronic form. No further response was received and no evidence of identity was provided. First, the court found that the person acting as the data subject had not demonstrated that they were the person affected by the underlying complaint procedure towards the supervisory authority. The court noted numerous indicators suggesting that the person acting in the procedure might not be the data subject, including failure to respond to repeated requests to prove identity, absence from the hearing, failure to provide requested medical evidence and personal/economic declarations. The court also referenced similar earlier cases by the same person (like 29 K 8881/22) where identity doubts had arisen. Because the person continued to press cases without establishing identity, the court stated it would in future simply file such claims rather than decide them. As a result, the objective and subjective elements of a legal interest in pursuing the alleged claim coul